Develectron Posted June 24, 2014 Share Posted June 24, 2014 I worked a lot now with my Wifi Pineapple Mark V but since a couple weeks now it keeps dropping a file called NCSI.txt in my /www folder Also today when i was doing some more tests i also came up with this: when i launched a Sslstrip and put the Auto-refresh on 1 sec i noticed also a text flash by with some csi stuff in it :) i opened up WinScp and browsed to my Sslstrip logs and this was in it: 2014-06-18 14:35:58,401 Resolving host: www.msftncsi.com 2014-06-18 14:35:58,404 Host not cached. 2014-06-18 14:35:59,308 Resolved host successfully: www.msftncsi.com -> 77.67.28.136 2014-06-18 14:35:59,311 Sending request via HTTP... 2014-06-18 14:35:59,631 HTTP connection made. 2014-06-18 14:35:59,634 Sending Request: GET /ncsi.txt 2014-06-18 14:35:59,640 Sending header: connection : Close 2014-06-18 14:35:59,643 Sending header: host : www.msftncsi.com 2014-06-18 14:35:59,646 Sending header: user-agent : Microsoft NCSI 2014-06-18 14:36:00,148 Got server response: HTTP/1.0 200 OK 2014-06-18 14:36:00,152 Got server header: Content-Length:14 2014-06-18 14:36:00,155 Got server header: Date:Wed, 18 Jun 2014 14:35:59 GMT 2014-06-18 14:36:00,158 Got server header: Connection:close 2014-06-18 14:36:00,161 Got server header: Content-Type:text/plain 2014-06-18 14:36:00,164 Got server header: Cache-Control:max-age=30, must-revalidate 2014-06-18 14:36:00,168 Read from server: Microsoft NCSI Now could someone tell me what this is ? :) and why it keeps popping up on my pineapple ? Thx in advance Quote Link to comment Share on other sites More sharing options...
Sebkinne Posted June 24, 2014 Share Posted June 24, 2014 I worked a lot now with my Wifi Pineapple Mark V but since a couple weeks now it keeps dropping a file called NCSI.txt in my /www folder Also today when i was doing some more tests i also came up with this: when i launched a Sslstrip and put the Auto-refresh on 1 sec i noticed also a text flash by with some csi stuff in it :) i opened up WinScp and browsed to my Sslstrip logs and this was in it: 2014-06-18 14:35:58,401 Resolving host: www.msftncsi.com 2014-06-18 14:35:58,404 Host not cached. 2014-06-18 14:35:59,308 Resolved host successfully: www.msftncsi.com -> 77.67.28.136 2014-06-18 14:35:59,311 Sending request via HTTP... 2014-06-18 14:35:59,631 HTTP connection made. 2014-06-18 14:35:59,634 Sending Request: GET /ncsi.txt 2014-06-18 14:35:59,640 Sending header: connection : Close 2014-06-18 14:35:59,643 Sending header: host : www.msftncsi.com 2014-06-18 14:35:59,646 Sending header: user-agent : Microsoft NCSI 2014-06-18 14:36:00,148 Got server response: HTTP/1.0 200 OK 2014-06-18 14:36:00,152 Got server header: Content-Length:14 2014-06-18 14:36:00,155 Got server header: Date:Wed, 18 Jun 2014 14:35:59 GMT 2014-06-18 14:36:00,158 Got server header: Connection:close 2014-06-18 14:36:00,161 Got server header: Content-Type:text/plain 2014-06-18 14:36:00,164 Got server header: Cache-Control:max-age=30, must-revalidate 2014-06-18 14:36:00,168 Read from server: Microsoft NCSI Now could someone tell me what this is ? :) and why it keeps popping up on my pineapple ? Thx in advance That's odd, it's not from us. Usually, msftncsi is used by Microsoft Windows to check for an internet connection, as you can see here. I assume that it is some program or infusion you installed which makes use of this. What infusions do you currently have installed? Best Regards, Sebkinne Quote Link to comment Share on other sites More sharing options...
Develectron Posted June 24, 2014 Author Share Posted June 24, 2014 Best Sebkinne That's a quick reply :) i currently got this infusions running get 1.3 144kbRemovednsspoof 1.5 100kbRemovenmap 1.4 72kbRemovetcpdump 1.3 80kbRemoveettercap 1.3 468kbRemovewifimanager 1.7 120kbRemoveardronepwn 1.0 3kbRemovesslstrip 1.6 104kbRemoveadsbtracker 1.4 8kbRemoveoccupineapple 1.6 116kbRemovegps-logger v1.0 40kbRemoveevilportal 2.1 76kbRemovestrip-n-inject 1.2 212kbRemovetorgateway 1.1 52kbRemovearping 1.0 20kbRemovejammer 1.6 112kbRemovephials 1.0 24kbRemovepineapplestats 1.0 364kbRemoveurlsnarf 1.5 84kbRemovesitesurvey 1.5 112kb Sorry that this is just copy pasted :p Remove Quote Link to comment Share on other sites More sharing options...
NullNull Posted June 24, 2014 Share Posted June 24, 2014 dnsspoof infusion creates that file. Also creates /www//library/test/success.html for iOS 6 or oldest versions for the same reason. The infusion has an option not to create those files Quote Link to comment Share on other sites More sharing options...
dustbyter Posted June 24, 2014 Share Posted June 24, 2014 I can confirm that get does not create that file. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.